OpenBSD PF 单个IP限速

rainren

做了一些网关, 一直是iptables + tc才能对网内每一个IP 限速! 用pf来做有点困难. 参考网上找到的许多规则, 实验了一些, 成了下面的规则, 各位可试验, 贴些自己的pf规则技巧, 让我也受益一些!

1. 
   
2. 
   
3. ext_if="pppoe0"
   
4. int_if="fxp1"
   
5. 
   
6. set state-policy if-bound
   
7. set block-policy return
   
8. set optimization aggressive
   
9. 
   
10. scrub in all
    
11. 
    
12. altq on $ext_if hfsc bandwidth 512Kb queue { u1, u2, u3, u4, u5, u6, u7, u8, u9, u10, u11, u12, u13, u14, u15, u16, u17, u18, u19, u20, u21, u22, u23, u24, u25, u26, u27, u28, u29, u30, uother }
    
13. queue u1 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
14. queue u2 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
15. queue u3 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
16. queue u4 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
17. queue u5 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
18. queue u6 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
19. queue u7 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
20. queue u8 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
21. queue u9 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
22. queue u10 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
23. queue u11 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
24. queue u12 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
25. queue u13 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
26. queue u14 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
27. queue u15 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
28. queue u16 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
29. queue u17 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
30. queue u18 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
31. queue u19 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
32. queue u20 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
33. queue u21 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
34. queue u22 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
35. queue u23 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
36. queue u24 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
37. queue u25 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
38. queue u26 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
39. queue u27 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
40. queue u28 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
41. queue u29 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
42. queue u30 bandwidth 16Kb hfsc ( upperlimit 128Kb red )
    
43. queue uother bandwidth 32Kb hfsc ( default upperlimit 128Kb )
    
44. 
    
45. altq on $int_if hfsc bandwidth 2Mb queue{ c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, other }
    
46. queue c1 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
47. queue c2 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
48. queue c3 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
49. queue c4 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
50. queue c5 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
51. queue c6 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
52. queue c7 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
53. queue c8 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
54. queue c9 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
55. queue c10 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
56. queue c11 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
57. queue c12 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
58. queue c13 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
59. queue c14 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
60. queue c15 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
61. queue c16 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
62. queue c17 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
63. queue c18 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
64. queue c19 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
65. queue c20 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
66. queue c21 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
67. queue c22 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
68. queue c23 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
69. queue c24 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
70. queue c25 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
71. queue c26 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
72. queue c27 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
73. queue c28 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
74. queue c29 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
75. queue c30 bandwidth 64Kb hfsc( upperlimit 512Kb red )
    
76. queue other bandwidth 80Kb hfsc( default upperlimit 128Kb)
    
77. 
    
78. nat on $ext_if from $int_if:network to any -> ($ext_if)
    
79. 
    
80. block all
    
81. block quick inet6 all
    
82. 
    
83. pass quick on lo0 all
    
84. 
    
85. antispoof for $ext_if
    
86. 
    
87. pass in on $ext_if inet proto tcp from any to ($ext_if) port ssh flags S/SA keep state
    
88. 
    
89. pass in quick on $int_if inet from 192.168.1.2 to any keep state tag 192.168.1.2 queue c1
    
90. pass out quick on $ext_if inet all keep state tagged 192.168.1.2 queue u1
    
91. 
    
92. pass in quick on $int_if inet from 192.168.1.3 to any keep state tag 192.168.1.3 queue c2
    
93. pass out quick on $ext_if inet all keep state tagged 192.168.1.3 queue u2
    
94. 
    
95. pass in quick on $int_if inet from 192.168.1.4 to any keep state tag 192.168.1.4 queue c3
    
96. pass out quick on $ext_if inet all keep state tagged 192.168.1.4 queue u3
    
97. 
    
98. pass in quick on $int_if inet from 192.168.1.5 to any keep state tag 192.168.1.5 queue c4
    
99. pass out quick on $ext_if inet all keep state tagged 192.168.1.5 queue u4
    
100. 
     
101. pass in quick on $int_if inet from 192.168.1.6 to any keep state tag 192.168.1.6 queue c5
     
102. pass out quick on $ext_if inet all keep state tagged 192.168.1.6 queue u5
     
103. 
     
104. pass in quick on $int_if inet from 192.168.1.7 to any keep state tag 192.168.1.7 queue c6
     
105. pass out quick on $ext_if inet all keep state tagged 192.168.1.7 queue u6
     
106. 
     
107. pass in quick on $int_if inet from 192.168.1.8 to any keep state tag 192.168.1.8 queue c7
     
108. pass out quick on $ext_if inet all keep state tagged 192.168.1.8 queue u7
     
109. 
     
110. pass in quick on $int_if inet from 192.168.1.9 to any keep state tag 192.168.1.9 queue c8
     
111. pass out quick on $ext_if inet all keep state tagged 192.168.1.9 queue u8
     
112. 
     
113. pass in quick on $int_if inet from 192.168.1.10 to any keep state tag 192.168.1.10 queue c9
     
114. pass out quick on $ext_if inet all keep state tagged 192.168.1.10 queue u9
     
115. 
     
116. pass in quick on $int_if inet from 192.168.1.11 to any keep state tag 192.168.1.11 queue c10
     
117. pass out quick on $ext_if inet all keep state tagged 192.168.1.11 queue u10
     
118. 
     
119. pass in quick on $int_if inet from 192.168.1.12 to any keep state tag 192.168.1.12 queue c11
     
120. pass out quick on $ext_if inet all keep state tagged 192.168.1.12 queue u11
     
121. 
     
122. pass in quick on $int_if inet from 192.168.1.13 to any keep state tag 192.168.1.13 queue c12
     
123. pass out quick on $ext_if inet all keep state tagged 192.168.1.13 queue u12
     
124. 
     
125. pass in quick on $int_if inet from 192.168.1.14 to any keep state tag 192.168.1.14 queue c13
     
126. pass out quick on $ext_if inet all keep state tagged 192.168.1.14 queue u13
     
127. 
     
128. pass in quick on $int_if inet from 192.168.1.18 to any keep state tag 192.168.1.18 queue c14
     
129. pass out quick on $ext_if inet all keep state tagged 192.168.1.18 queue u14
     
130. 
     
131. pass in quick on $int_if inet from 192.168.1.19 to any keep state tag 192.168.1.19 queue c15
     
132. pass out quick on $ext_if inet all keep state tagged 192.168.1.19 queue u15
     
133. 
     
134. pass in quick on $int_if inet from 192.168.1.20 to any keep state tag 192.168.1.20 queue c16
     
135. pass out quick on $ext_if inet all keep state tagged 192.168.1.20 queue u16
     
136. 
     
137. pass in quick on $int_if inet from 192.168.1.21 to any keep state tag 192.168.1.21 queue c17
     
138. pass out quick on $ext_if inet all keep state tagged 192.168.1.21 queue u17
     
139. 
     
140. pass in quick on $int_if inet from 192.168.1.22 to any keep state tag 192.168.1.22 queue c18
     
141. pass out quick on $ext_if inet all keep state tagged 192.168.1.22 queue u18
     
142. 
     
143. pass in quick on $int_if inet from 192.168.1.23 to any keep state tag 192.168.1.23 queue c19
     
144. pass out quick on $ext_if inet all keep state tagged 192.168.1.23 queue u19
     
145. 
     
146. pass in quick on $int_if inet from 192.168.1.24 to any keep state tag 192.168.1.24 queue c20
     
147. pass out quick on $ext_if inet all keep state tagged 192.168.1.24 queue u20
     
148. 
     
149. pass in quick on $int_if inet from 192.168.1.25 to any keep state tag 192.168.1.25 queue c21
     
150. pass out quick on $ext_if inet all keep state tagged 192.168.1.25 queue u21
     
151. 
     
152. pass in quick on $int_if inet from 192.168.1.26 to any keep state tag 192.168.1.26 queue c22
     
153. pass out quick on $ext_if inet all keep state tagged 192.168.1.26 queue u22
     
154. 
     
155. pass in quick on $int_if inet from 192.168.1.27 to any keep state tag 192.168.1.27 queue c23
     
156. pass out quick on $ext_if inet all keep state tagged 192.168.1.27 queue u23
     
157. 
     
158. pass in quick on $int_if inet from 192.168.1.28 to any keep state tag 192.168.1.28 queue c24
     
159. pass out quick on $ext_if inet all keep state tagged 192.168.1.28 queue u24
     
160. 
     
161. pass in quick on $int_if inet from 192.168.1.29 to any keep state tag 192.168.1.29 queue c25
     
162. pass out quick on $ext_if inet all keep state tagged 192.168.1.29 queue u25
     
163. 
     
164. pass in quick on $int_if inet from 192.168.1.30 to any keep state tag 192.168.1.30 queue c26
     
165. pass out quick on $ext_if inet all keep state tagged 192.168.1.30 queue u26
     
166. 
     
167. 
     
168. 
     
169. 
     
170. 
     

复制代码

llzqq

这个在PF上配置，总显得比较繁琐。

rainren

pf.conf 不能在自动生成一些相似行！ iptables规则可shell编程。

yewei1012

pf规则算很灵活了。
另外，做nat的话，ipfw/natd 跟pf没得比。

像把刀子

老大
iptables可以控制mac地址来限制上网需求不？

ioerr

这个pf太那个了吧，好麻烦啊，要是能按照地址列表限速就舒服些了

sjfff99

是不是太麻烦了.要是带个300台机子.
那得写多少规则.

kisswen

可以用table吗

sjfff99

有写好的或教程吗///
QQ:358340779